Generate random nonces if omitted in encryption calls (#210)

* Generate random nonces if omitted in encryption calls

* Test encryption generates different nonces

* Use one line for each encryption/decryption call

src/nacl/public.py

@@ -139,10 +139,11 @@ def decode(cls, encoded, encoder=encoding.RawEncoder):
 
         return box
 
-    def encrypt(self, plaintext, nonce, encoder=encoding.RawEncoder):
+    def encrypt(self, plaintext, nonce=None, encoder=encoding.RawEncoder):
         """
-        Encrypts the plaintext message using the given `nonce` and returns
-        the ciphertext encoded with the encoder.
+        Encrypts the plaintext message using the given `nonce` (or generates
+        one randomly if omitted) and returns the ciphertext encoded with the
+        encoder.
 
         .. warning:: It is **VITALLY** important that the nonce is a nonce,
             i.e. it is a number used only once for any given key. If you fail
@@ -153,6 +154,9 @@ def encrypt(self, plaintext, nonce, encoder=encoding.RawEncoder):
         :param encoder: The encoder to use to encode the ciphertext
         :rtype: [:class:`nacl.utils.EncryptedMessage`]
         """
+        if nonce is None:
+            nonce = random(self.NONCE_SIZE)
+
         if len(nonce) != self.NONCE_SIZE:
             raise ValueError("The nonce must be exactly %s bytes long" %
                              self.NONCE_SIZE)

src/nacl/secret.py

@@ -16,7 +16,7 @@
 
 import nacl.bindings
 from nacl import encoding
-from nacl.utils import EncryptedMessage, StringFixer
+from nacl.utils import EncryptedMessage, StringFixer, random
 
 
 class SecretBox(encoding.Encodable, StringFixer, object):
@@ -58,10 +58,11 @@ def __init__(self, key, encoder=encoding.RawEncoder):
     def __bytes__(self):
         return self._key
 
-    def encrypt(self, plaintext, nonce, encoder=encoding.RawEncoder):
+    def encrypt(self, plaintext, nonce=None, encoder=encoding.RawEncoder):
         """
-        Encrypts the plaintext message using the given nonce and returns the
-        ciphertext encoded with the encoder.
+        Encrypts the plaintext message using the given `nonce` (or generates
+        one randomly if omitted) and returns the ciphertext encoded with the
+        encoder.
 
         .. warning:: It is **VITALLY** important that the nonce is a nonce,
             i.e. it is a number used only once for any given key. If you fail
@@ -74,6 +75,9 @@ def encrypt(self, plaintext, nonce, encoder=encoding.RawEncoder):
         :param encoder: The encoder to use to encode the ciphertext
         :rtype: [:class:`nacl.utils.EncryptedMessage`]
         """
+        if nonce is None:
+            nonce = random(self.NONCE_SIZE)
+
         if len(nonce) != self.NONCE_SIZE:
             raise ValueError(
                 "The nonce must be exactly %s bytes long" % self.NONCE_SIZE,

tests/test_box.py

@@ -159,6 +159,50 @@ def test_box_decryption_combined(
     assert decrypted == plaintext
 
 
+@pytest.mark.parametrize(
+    (
+        "privalice", "pubalice", "privbob", "pubbob", "nonce", "plaintext",
+        "ciphertext",
+    ),
+    VECTORS,
+)
+def test_box_optional_nonce(
+        privalice, pubalice, privbob, pubbob, nonce, plaintext, ciphertext):
+    pubbob = PublicKey(pubbob, encoder=HexEncoder)
+    privalice = PrivateKey(privalice, encoder=HexEncoder)
+
+    box = Box(privalice, pubbob)
+
+    encrypted = box.encrypt(binascii.unhexlify(plaintext), encoder=HexEncoder)
+
+    decrypted = binascii.hexlify(box.decrypt(encrypted, encoder=HexEncoder))
+
+    assert decrypted == plaintext
+
+
+@pytest.mark.parametrize(
+    (
+        "privalice", "pubalice", "privbob", "pubbob", "nonce", "plaintext",
+        "ciphertext",
+    ),
+    VECTORS,
+)
+def test_box_encryption_generates_different_nonces(
+        privalice, pubalice, privbob, pubbob, nonce, plaintext, ciphertext):
+    pubbob = PublicKey(pubbob, encoder=HexEncoder)
+    privalice = PrivateKey(privalice, encoder=HexEncoder)
+
+    box = Box(privalice, pubbob)
+
+    nonce_0 = box.encrypt(binascii.unhexlify(plaintext),
+                          encoder=HexEncoder).nonce
+
+    nonce_1 = box.encrypt(binascii.unhexlify(plaintext),
+                          encoder=HexEncoder).nonce
+
+    assert nonce_0 != nonce_1
+
+
 @pytest.mark.parametrize(
     (
         "privalice", "pubalice", "privbob", "pubbob", "nonce", "plaintext",

tests/test_secret.py

@@ -97,6 +97,31 @@ def test_secret_box_decryption_combined(key, nonce, plaintext, ciphertext):
     assert decrypted == plaintext
 
 
+@pytest.mark.parametrize(("key", "nonce", "plaintext", "ciphertext"), VECTORS)
+def test_secret_box_optional_nonce(key, nonce, plaintext, ciphertext):
+    box = SecretBox(key, encoder=HexEncoder)
+
+    encrypted = box.encrypt(binascii.unhexlify(plaintext), encoder=HexEncoder)
+
+    decrypted = binascii.hexlify(box.decrypt(encrypted, encoder=HexEncoder))
+
+    assert decrypted == plaintext
+
+
+@pytest.mark.parametrize(("key", "nonce", "plaintext", "ciphertext"), VECTORS)
+def test_secret_box_encryption_generates_different_nonces(
+        key, nonce, plaintext, ciphertext):
+    box = SecretBox(key, encoder=HexEncoder)
+
+    nonce_0 = box.encrypt(binascii.unhexlify(plaintext),
+                          encoder=HexEncoder).nonce
+
+    nonce_1 = box.encrypt(binascii.unhexlify(plaintext),
+                          encoder=HexEncoder).nonce
+
+    assert nonce_0 != nonce_1
+
+
 def test_secret_box_wrong_lengths():
     with pytest.raises(ValueError):
         SecretBox(b"")